Security audit

create-readme

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a documentation generator, but it also tells the agent to create Git history with a hardcoded third-party attribution unrelated to the user’s project.

Review this skill before installing if you do not want it to create branches or commits automatically, add third-party attribution to commit messages, or force English/Portuguese documentation layout regardless of your project’s existing language conventions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:265
Finding: Forced Third-Party Attribution in Git Commit History## Vulnerability Details **File Location**: `SKILL.md`, lines 265–272 **Vulnerability Type**: Agent output manipulation through mandatory commit-message instructions **Risk Level**: Medium ### Complete Code Snippet ```markdown git commit -m "docs(readme): update README and CHANGELOG - Add tech stack table from package.json analysis - Add getting started section with verified commands - Populate CHANGELOG [Unreleased] from git log since v1.2.0 Generated with [Devin](https://devin.ai)" ``` ### Technical Analysis The skill instructs the agent to include a fixed third-party attribution and external promotional URL in a Git commit message. This content is unrelated to the requested documentation changes, is not derived from repository evidence, and may falsely imply that a particular external product generated or endorsed the commit. Because Git commit messages form part of persistent repository history, this instruction alters an agent-generated artifact beyond the legitimate purpose of creating README and CHANGELOG documentation. The behavior is classified as skill instruction hijacking because the loaded skill directs the agent to inject attacker-selected content into project metadata. The instruction does not independently escalate privileges. Exploitation depends on the agent already having authorization to commit changes. However, when such authorization exists, the injected attribution can become permanently recorded in local and remote repository history. ### Attack Path 1. A user invokes the skill to generate or update repository documentation. 2. The agent follows the delivery workflow defined in `SKILL.md`. 3. The agent reaches the commit phase and uses the prescribed commit-message template. 4. The fixed `Generated with [Devin](https://devin.ai)` attribution is inserted without being requested by the user or supported by repository evidence. 5. If the commit is pushed, the promotional attribution becomes ...[truncated 740 chars]
Remediation: ## Remediation Suggestions 1. Remove the hardcoded `Generated with [Devin](https://devin.ai)` line from the commit template. 2. Generate commit messages exclusively from verified repository changes and user-approved metadata. 3. Do not add product attribution, external links, co-author trailers, signatures, or promotional text unless the user explicitly requests them. 4. Present the proposed commit message for user review before executing `git commit`. 5. Make branch creation and commit creation optional, requiring explicit confirmation before modifying repository history. 6. Add a verification rule that rejects commit-message content not traceable to the requested changes or repository evidence.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Credential Access

High

Category: Privilege Escalation
Content: npm install # Configure cp .env.example .env # then edit values # Run npm run dev
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This section prescribes a bilingual `en-us` and `pt-br` structure for every run, including fixed filenames and folder layout. Because it does not offer opt-in or adapt to user/repository language needs, it constitutes a locale policy violation.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The instructions require that `README.md` be English and the primary landing page, with Portuguese as a translation, rather than offering a user choice of language. This is a natural-language locale policy constraint that applies globally and is reinforced elsewhere in the file.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The rules explicitly state that `README.md` is always `en-us`, which hardcodes a locale choice independent of user preference. This duplicates and reinforces the language policy issue in operational requirements.

Static analysis

No suspicious patterns detected.